Social Good

Stalker in the Attic: The Cyberbully Who Spies on 12-Year-Old Girls in Their Home

Julia Young and Melody Coffey, both 12, review their social media in the former's room, in Leander, Texas. The two girls are the centerpieces of a violent cyberbullying, hacking and real-world stalking case that's still under investigation.

This piece is part of Mashable Spotlight, which presents in-depth looks at the
people, concepts and issues shaping our digital world.

On a Monday afternoon in late March, 12-year-old best friends Melody Coffey and Julia Young sat in Melody's room, mulling the latest message from their tormentor:

wanna play a game ?

The girls recognized the sender's Instagram account as belonging to a girl we'll call Danielle. She and Julia were friends briefly earlier in the year. Since their falling out with Danielle, Melody and Julia had been receiving disturbing threats from her social media accounts.

Let's switch passwords

The oddly punctuated messages had grown more sinister, more perverse. Though Danielle denied they were from her — she suggested her accounts were hacked — the evidence was not in her favor. The attacks referenced the girls' families and their friends from school and even now, above the latest message, was a selfie of Danielle, phone held up to the mirror.

I have a guy who takes photos of you guys . My mom helps me . Don't think I'm weird though . Everyone does it . … I know you guys will like call the cops because you guys are insane , but thats what I find sexy about you guys .

In Melody's room, avoiding yet another day of gossip at school, the girls considered their options. Sometimes, Melody said, it seemed Danielle could hear them talking, as if she were watching them. She'd even convinced her mom to climb up and check the attic once. It was empty.

Now Melody yelled for her mother to watch the new messages come in.

There is someone in you're attic , he tells me everything .

The girls ran screaming from the room and hid under the kitchen counter. Could Danielle or her friend have heard them? Seen them? Julia replied from her phone with a test:

What r we wearing?

He's says you're not in melody's room … So you have to go in There for him to see you're shirts

The girls quietly walked back in. They circled the room, middle fingers raised to a camera they imagined hidden in the ceiling. The reply came before long:

Julia's wearing a pink shirt and melody's wearing a white shirt .. And don't flip him off , it's rude

Image: Marti Coffey

This spring, Melody and Julia's story was big drama in the little world of Florence Stiles Middle School in Leander, Texas. Kids gossiped about the latest message from Danielle; Danielle insisted she wasn't behind it; school administrators met with police and held anti-bullying rallies.

But by May, the case had outgrown their school, even their suburb. The jealous spat among three girls progressed to cyberbullying and then, apparently, to hacking, online surveillance and real-world stalking. The families enlisted investigators from four law enforcement agencies, private eyes and experts in online security and forensics to make sense of the strange harassment, which seemed to turn every networked device in their homes against them. After Julia's mother, a blogger with a devoted following, wrote about the ordeal, the case became a crusade among her flock. Anti-bullying activists championed the cause, calling it the worst case of cyberbullying they had ever seen.

To others it seemed a blatant hoax, a bid for sympathy or attention too absurd to be believed. And by June, with no certain suspects or explanations, the threat was apparently over. The messages stopped, the clues dried up, the trail went cold. School staff and police seem baffled. The community, wrapped in forces they still don't understand, is left to wonder how 12-year-olds, or their phones, could be capable of such a complex scheme.

Twenty-five miles from downtown Austin, a world away from the capital city's food trucks, housing co-ops and all-night coffee shops, Leander sits at the northern edge of central Texas' urban sprawl. This is conservative Williamson County. Unforgiving cops patrol Ronald Reagan Boulevard; fresh McMansions fill neighborhoods named for prefabricated creeks and ranches. A few traces of old Leander, hemmed-in pastures and old trailer parks, still fill the seams between the construction, but none shines as bright as the new mega Walmart.

This is where Ray and Christine Young chose to settle with their seven children in the summer of 2013. Texas was a cheaper headquarters than California for his public relations firm. When they moved, Christine Young wrote an influential blog called From Dates to Diapers; she reviewed products on contract with suppliers like Walmart, and meditated on the fun and trials of raising an enormous family. In 2009, Nielsen Online ranked hers among the top 50 mommy blogs in the nation.

Their daughter, Julia Young, is the second-oldest of her siblings, and the only girl. Leaving her old friends behind in Sacramento, she entered sixth grade at Stiles Middle School, a new addition to Leander's fast-growing school system with an affluent, mostly white student body. By sixth grade, most kids had their own phones, and extracurricular life carried on late into the night on social media. New friends connected by swapping Instagram names first and phone numbers second.

Julia, wide-eyed and talkative, thrived in the high-energy mix. A few months after getting her first iPhone, she had 3,000 Instagram followers and a boyfriend from class. Julia quickly fell in with Melody Coffey, a quieter, more serious girl who'd come to Stiles from private school. They both landed high in the school's social order, served well by their new-kid mystiques.

From left: Christine and Julia Young, and Marti and Melody Coffey, at the Youngs' home in Leander, Texas.

Image: Mashable

Danielle, the girls say, was a "popular girl" of a different sort, outside the mainstream but more grown-up than the others, more familiar with the world outside school. She lived with her mother and stepdad, and sometimes stayed with her grandmother. She told some kids at school she was homeless. In a school of 670, she was one of two dozen African-American students. She drifted from one group of friends to the next and had already cycled in and out of Julia and Melody's clique by February.

The week after Valentine's Day, Julia received a Kik message from Danielle saying she was jealous of Julia's new boyfriend. In P.E. the next day, Julia says Danielle threatened to kill herself, and repeated it that night on Kik. The messages continued on Instagram and Kik: sex-obsessed taunts with consistently bad punctuation. When Danielle told the school counselor that Julia and Melody were bullying her, Melody says, they defended themselves by producing Danielle's messages. School officials declined to comment for this story, citing student privacy laws.

Then, on Feb. 23, a startling development: Melody's own Instagram account posted a photo with the caption, "You stole Julia from me ! UGH." Above sat a picture of the evil clown horror meme Jeff the Killer: a ghost-white face, beady black eyes and broad grin, with the words "GO TO SLEEP" in red. Melody showed the post to her mother, puzzled and afraid.

Jeff the Killer's appearance marked the first time the girls say an attack came from their own accounts.

Image: Marti Coffey

Melody's mother Marti was so shaken, she commented on the post: "I will be calling the police if you do not return the account back to Melody." Instead, all of Melody's photos were deleted from her account. Only Jeff the Killer remained. The name on Danielle's Instagram account changed to "Julia and Melody Sucks." Instagram sent Melody an email to confirm that her username had been changed to "hackeddddddddddddddd______" and the email on her account changed to "danielle_has_hacked_youre_ass_bitch@gmail.com."

Image: Marti Coffey

Julia and Melody's parents reported it all to the police, but soon realized investigators had little experience with or knowledge of the technology, much less enthusiasm for the case.

"The main thing we get is, ‘Oh, it's not a big deal. I'm dealing with a rape case,'" Julia's father Ray Young says. "‘Oh, what if it's her brothers, what if it's you guys, just some little prank.'"

Neither the Leander Police Department nor the Williamson County Sheriff's Office would comment for this story; the cases remain open investigations. Police did issue subpoenas to Instagram for IP addresses of the sender of the messages attributed to Danielle — but so far, apparently, there has been no reply. When reached by Mashable, Instagram wouldn't comment on the case, instead referring us to its policies for law enforcement and a prohibition on bullying.

Marti Coffey keeps printed records of all the cyberbullying attacks in this ongoing case. The binder is now four inches thick.

Image: Mashable

Like other parents involved in the case, Marti was skeptical at first, too. She wondered whether Melody and Julia, or one of their siblings, were to blame. But she witnessed too much firsthand to believe it was an inside job. "I know they could have played us. I don't know how they could have played us every single time," she says.

To build their case, they settled into a routine: Marti watched the screen as Melody or Julia read the messages aloud. One girl took screenshots and emailed them to Marti, who printed and three-hole punched the pages into a binder. (Messages quoted in this piece come from that collection of screenshots Mashable reviewed. While they don't appear to have been doctored, Mashable did not independently verify their authenticity.) The family kept a timeline, noted patterns, evidence that could implicate or exonerate possible suspects: messages that came while the Young children were all asleep, eliminating them from suspicion; or messages that stopped when Danielle's friends were pulled into the principal's office and separated from their phones, suggesting they could have a role.

Amid one late-night string of messages, Marti called Danielle's parents to insist Danielle's stepdad check on her, catch her in the act and make her stop once and for all. But Danielle was asleep, he said. Her phone had been with him all night. Best he could figure, she had been hacked, too.

From February to May the binder of screenshots grew thick.

Image: Marti Coffey

I'm sick of bullies I get you don't like me but does that mean you have to be so hateful I'm so tired of hearing " stay strong danielle you can do it…" when we all know sooner or later I'm gonna break.

Danielle — or someone pretending to be her — left that message on Instagram in May. By then, says her stepdad, it had been a full year (not weeks) since he first heard accusations from other parents about Danielle. Melody and Julia weren't even classmates with Danielle then. The Young family hadn't even left California. It's an alibi of sorts for the Young and Coffey girls, but it also suggests Danielle could have been targeted, possibly by other classmates, for a long time.

Her stepfather says he spent months calling police before an officer showed up. When one did, "[Danielle] straight up told the police officer herself, ‘I'm not gonna admit to something I didn't do.' And she gave up both of her phones just like no other, and she said, 'Please find out who's doing this to me,'" recalls her stepfather.

They switched Danielle's phone number and got her a new phone, but the messages continued.

"Facebook, Twitter, Kik, Tumble ... Tumblr or whatever the hell it is ... I'm not computer savvy," he says. "If we had a problem with someone back in my day, we'd go back in the playground and we'd box it out."

A rift split the sixth grade class: Team Julia or Team Danielle. Kids changed their account profiles to proclaim which side they'd chosen. After each new post on @fsmscutestcouples — a widely followed Instagram account controlled by Danielle, or whoever played her on Instagram — classmates rushed Julia and Melody like paparazzi.

Students untouched by the drama told Julia and Melody they envied the attention the girls were getting. Melody recalls one girl, who'd never received any messages from Danielle, breaking down in tears in class over the ordeal. The controversy touched other families, too: Darla Kelley, a mother of a sixth-grade girl who received threats from Danielle's account, worried for her daughter's safety at school. Her only consolation was that a school principal shadowed her daughter between classes for weeks.

Teachers treated Melody and Julia with deference, but Julia says it only made the distraction worse: "I'm like, ‘I'm a normal person. You don't need to baby me.'"

Image: Marti Coffey

Though Danielle insisted on her innocence during the school day at Stiles and online, other messages from her old account — and new ones bearing her name and picture — claimed it had been her all along. Team Danielle, finding the confessions more compelling, gradually abandoned her.

By March 17, less than a month after the message to Julia, Danielle's parents pulled their daughter from Stiles. The night before her exit, Julia got a parting Kik message from Danielle's account:

Tomorrow's my last day . Fuck you , and whatever , at my new school I'll tell everyone that you lost your virginity , they won't know you and they will believe me . … goodbye my broken princess .

Once she left middle school, Danielle's powers seemed only to multiply. On April 1, Julia's mom, Christine, opened Instagram to find her profile photo deleted and her bio changed to "I'm a hater, lol." In four hours, From Dates to Diapers got two dozen login attempts from an unfamiliar IP address.

The Coffey's home wireless network had become the target of a broader security breach. Because of the timing, Marti is certain it connects with their social media troubles. At one point Marti found their Wi-Fi disabled. She ran a search and found four different IP addresses assigned to her network, two from a small town 50 miles away, another on a blacklist of domains known as common sources of spam emails. For an attack she believes began with a pre-teen, it was a cruel reversal to find herself without administrative privileges on her own home network.

"I was the child system," she says, "no longer the parent system."

She drove the girls to a spy shop in Austin to learn how their phones had been bugged, then to the computer shop next door, where a repair man was baffled. At Best Buy, a technician suggested their home network had been hacked and their cellphones cloned — that someone copied their SIM cards in order to spy on their texts from another phone.

But that only explained some of the trouble. A detective told her nobody could bug an iPhone unless it had been jailbroken, but a friend employed by Apple revealed it is, in fact, a little-known possibility. A Time Warner Cable technician near Marti's house offered to contact an ex-con friend who knew networks well; the friend suggested some LAN remote access software was at work, but couldn't be specific.

Marti contacted a company named CyberDefenses to sweep the house for bugs, but the search came up empty. She had the phones checked for malware. Nothing. They installed security cameras in the front of their house; within minutes, one of Danielle's accounts taunted that the cameras were a nice try, but not good enough.

The Coffeys switched from Time Warner Cable to AT&T Uverse, got a new modem and a new router. Marti traded her Samsung Galaxy S4 for an S5, then traded that for an iPhone. For a while she only used a simple, prepaid Cricket phone. Her old Toshiba was playing host to unmentionable viruses. Within days of buying a new one, it too crawled with strange programs and files. She found VPN software installed and imagined the worst: Her home had become a way station for illicit material changing hands on the deep web, and there was nothing she could do.

In the God-fearing heart of Williamson County, a gremlin seemed to lurk in the Coffey household, tearing at the wires and the airwaves and their sanity. Marti felt the devil's hand at work. After a while, her fear gave way to frustration. "I just want to know how they do it," she says.

Marti and Melody Coffey in the Young household in Leander, Texas.

Image: Mashable

Analysts Mashable contacted said Marti's Samsung phone, or certainly her PC laptops, could be susceptible to a remote administration tool snuck onto her machine in a phishing scheme — as in the Miss Teen USA/Blackshades case. IPhones are a different story. The supposedly bugged phones, transmitting audio and video from the camera without the girls' knowledge, present a sizable challenge.

"Without a jailbreak, I'd say the likelihood is probably very slim, especially for kids," says Jonathan Zdziarski, an iPhone forensics investigator with viaForensics.

Chester Wisniewski, an expert with security firm Sophos, says that with Julia or Melody's Apple ID password, someone could access their photos through iCloud, but couldn't commandeer their cameras or social media apps. Most "hacking" cases are really about someone guessing your password.

"It's like one of those summer horror movies where the ax murderer's in the house," Wisniewski says. "It's gotta be scary as heck if it's happening to you and you don't understand how."

Melody refused to sleep in her bedroom. Julia ran crying to her mother as new attacks appeared, calling her ugly, a slut, threatening to spread lies.

Then they discovered Melody's phone was logged in to one of Danielle's Instagram accounts. The parents took it as chilling proof Danielle was using their phones as part of the scheme.

One Sunday afternoon in early March, Melody asked Marti if she should still be going to school. Marti told her sure, as long as she wasn't getting death threats. Within 15 minutes, the first death threat arrived via direct message from Julia's Instagram account:

…If you don't kill yourselves, I will. You can go ahead and tell Julia that I am on her account, and I'm going to pretend to be her. I'm going to make everyone hate her.

The Coffeys and the Youngs filed online impersonation charges against Danielle with the local police. Hoping to reach more tech-savvy investigators, they asked for help at the FBI office in Houston, then reached a director at the Texas Attorney General's Office. Marti emailed: "How can we explain the situation to a channel of law enforcement capable of dealing with the sophistication of these crimes?" But the FBI wouldn't get involved because it would interfere with the two local agencies' already open cases. The attorney general's office could only offer assistance to local police. And Marti says Leander PD refused the help.

With nowhere else to turn, they reasoned, it was time to tell their story.

On April 3, the girls posted their first video to a Facebook page Christine created called "Cyberbully Victims." The caption beside the video: “We are real and our story is real.”

At this point, they'd been accused of fabricating the story, even from classmates who later received threats from a "Danielle account." They knew they'd face even stiffer criticism online.

As they logged the latest threats from Instagram and Twitter on the Facebook page, the real-world threats deepened. First, the message about the man in the attic. Then on April 8, while Julia and Melody were studying in Melody's room, they got a message claiming to be from Danielle, who said she could see them doing homework and hear their music. Leaving their phones inside, they walked to the front yard with Marti and Christine, just in time to see a white truck go by. Returning inside, Julia picked up her phone. "There was a text saying, 'I just drove by, I'm going to go eat, I'll talk to you guys later,'" she recalls. Christine adds, "‘And that was me in the white truck.'"

They began tracking unfamiliar cars on their streets, reporting license plate numbers to the police.

Christine hatched a plan with Marti — without telling the girls, communicating only on handwritten notes and borrowed cellphones — to send Julia and Melody to California to live with Christine's sister.

On the West Coast, the girls got new phones. Weeks passed with no word from Danielle.

On From Dates to Diapers, Christine recounted the confounding horrors they'd endured. The post circulated among Christine's mommy blogging peers and anti-bullying activists, some whose own children had been pushed to the brink of suicide.

"This goes beyond anything I could wrap my head around," says Wendy Del Monte, an activist who blogs at The Anti-Bully Mom. "It's so absurdly evil that I can't think of how to fix it."

Strangers from around the country contacted Austin media, and the local ABC and Fox affiliates reported on the case: the binder of screenshots, the now-empty bedroom Julia had fled. Yet until they were reached for comment for this story, neither Danielle nor her parents had any idea the evening news had featured such accusations against her.

Christine's defenders, riled by the blog post and TV reports, soon found Danielle's Twitter account and let her have it. @MommyGoggles captured the prevailing tone, tweeting at Danielle on May 8:

Image: Twitter / @driving85

The mystery had become a witch hunt. In their fervor to out the culprit, many of Christine's defenders unleashed attacks about as vicious as anything ever posted under Danielle's name. Christine's story — most of all her decision to name Danielle in the post, and her apparent lack of skepticism — met rich derision from hoax-weary commenters online. At Goodbye Cruel Nest, a spinoff from the family blog The Nest, commenters picked apart Christine's blog post in a 40-page thread with messages like:

Two things jump to mind here:

1) Salem Witch Trials. Have you read The Crucible?

2) Occam's Razor: which seems more likely here — that one 12-year-old girl has the skills and resources of the NSA, enabling her to bug the homes and hack the devices of TWO separate families OR that the two girls are pretending to be "hacked" while they perpetrate this shit themselves under the protective blanket of their parents' ignorance and unwillingness to see the obvious?

The consensus was this puzzle has a simple solution: that there is no after-school special, no cyberbully panic here at all, just two girls taking their clueless parents for a ride.

Others were dubious of anything born in the mommy blog world, steeped as it is in marketing hype. And what better way to draw attention than to stage a stunt like this?

Christine insists she gets why people are skeptical, but can't see what she'd gain by making it up. She's missed cruises and networking trips, and hasn't had time for her blog or the product reviews she had agreed to write. She's had less attention to spare for her six sons. She made it public, she says, because other parents should know what's possible.

From left: Christine and Julia Young, Melody and Marti Coffey, at the Youngs' home in Leander, Texas.

Image: Mashable

"You always hear of victim-shaming," she says. "And now that we're in the throes of all this, it's really become our reality. Our girls are the victims, and they're made to look like the criminals. And this girl who's torturing our girls is made to look like the victim."

Marti and Christine don't suspect Danielle alone is to blame, but they do suspect her family, who they imagine has enlisted a group of hackers to team up to carry out the attack. Christine says, "I'm not afraid of a 12-year-old girl. But I am afraid of who's helping her."

After a few weeks in California, Julia and Melody returned to Texas. At the time of writing, the attacks have relented. But any time Christine's phone drops a call, or Marti finds an app on her computer she doesn't remember installing, they wonder. "I'm not 100% confident," Marti says. "I still feel like they want to get in. I feel like I'm on that list."

As we sit and talk at her dining room table, her youngest boys and other neighborhood kids carry toys and shuffle in and out the front door. In Julia's bedroom, she and Melody sing along to a song playing on her new iPhone.

"Cops and other people say, ‘Why do your kids even have a phone? Why are they even on social media?'" Christine says. "But socializing is completely changing. My boys are running around the neighborhood, but my 12- and 13-year-olds are chatting online." She says she tracks the apps her children download, tries them all out and keeps their passwords to look in on their accounts. But there's no sense trying to shut off her kids' interest. "A lot of my friends are virtual friends," Christine says. "I'd be completely naïive if I thought my kid wouldn't want that."

Melody and Julia will start seventh grade together at a new school this fall. Concerned for the girls' safety, their parents won't say where. While they wait for Instagram to return the subpoenaed IP addresses for Danielle's messages, Christine and Marti don't expect any revelations. "But I do believe it's gonna come back to us," Christine says. Since their phones were hijacked anyway, they figure the only IP addresses on the messages will be their own. If that happens, she says, the police have told her she can simply drop the charges and walk away.

Whatever answers may come, Danielle's mother says she is certain of one thing: "All I can say is, there's gonna be a lot of people that owe my daughter a big apology."

Mashable
is a global, multi-platform media and entertainment company. Powered by its own proprietary technology, Mashable is the go-to source for tech, digital culture and entertainment content for its dedicated and influential audience around the globe.